Week 5, Day 2 — Teams Policies & Messaging Governance

Day 1 review & the need for policy control

• Ask: "Every Lakeview Logistics user currently has the same Teams experience — same meeting options, same messaging permissions, same apps available. Is that the right model?" — prime the answer: different roles need different controls. Executives need full meeting capabilities. Front-line staff may not need external calling. Finance users may need stricter messaging controls.
• Ask: "What is the difference between a team setting (configured in Day 1 Step 5) and a Teams policy?" — prime: team settings apply to one team; policies apply to users regardless of which team they are in
• Frame the day: Teams policies are the user-level control layer. They are assigned to individual users (or groups of users) and travel with the user into every team and every meeting they join.

Teams policy types, the cascade model, and policy packages

Teams has five major policy types, each governing a different surface. The cascade model determines which policy applies when multiple could — and getting it wrong is the most common Teams admin mistake.

The five policy types

The policy cascade — which policy wins?

• The Global policy — every policy type has a Global policy that applies to all users by default. When you first set up Teams, every user has the Global policy for meetings, messaging, apps, and calling. Modifying the Global policy changes the baseline for everyone who has no explicit assignment. This is the most impactful single change — be deliberate about it.
• Policy packages — a policy package is a bundle of pre-configured policies designed for a specific user role. Microsoft ships packages for: Frontline worker, Frontline manager, Healthcare clinical worker, Healthcare information worker, Education (student), Education (educator), and a few others. You can also create custom packages. Assigning a package assigns all the bundled policies at once — useful for large-scale deployments. Individual policy assignments always override package assignments.
• Group policy assignment and ranking — when a user belongs to multiple groups that each have a policy assigned, the group with the lowest rank number wins. Rank 1 beats rank 2. If rank is equal, the larger group wins. This ranking is per-policy-type — a user could get their meeting policy from Group A (rank 1) and their messaging policy from Group B (rank 2).
• Effective policy — the "what does this user actually get?" question — in the Teams Admin Centre under Users → select a user → Policies tab, you can see the effective policy for each policy type — whether it came from a direct assignment, a group assignment, or the global default. This is the first tool to use when a user reports unexpected Teams behaviour.

Lab 5-B: Configuring Teams policies for Lakeview Logistics

Students review and tune the Global meeting and messaging policies, create a custom messaging policy for Finance users, assign it via group assignment, configure an app permission policy, and verify effective policies on specific users.

• Step 1 — Review the Global policy baseline (8 min)
  Navigate to admin.teams.microsoft.com → Meetings → Meeting policies → Global (Org-wide default). Review every setting. Note which settings are currently On and which are Off. Record the baseline before making any changes.
  
  Then navigate to Messaging policies → Global (Org-wide default). Do the same.
• Step 2 — Tune the Global meeting policy (12 min)
  In the Global meeting policy, configure the following settings for Lakeview Logistics's baseline:
  · Allow cloud recording: On
  · Allow transcription: On
  · Who can bypass the lobby: People in my organisation and guests
  · Automatically admit people: People in my organisation
  · Allow anonymous users to join a meeting: Off
  · Allow Meet Now in channels: On
  · Allow the removal of participants: On (organisers only)
  Save the policy. Record all changed settings and their previous values.
• Step 3 — Create a custom Finance messaging policy (15 min)
  Navigate to Messaging policies → + Add. Create a policy named: LL — Finance Messaging.
  Configure:
  · Owners can delete sent messages: On
  · Users can delete sent messages: Off
  · Users can edit sent messages: Off
  · Read receipts: User controlled
  · Chat: On
  · Use giphy in conversations: Off
  · Use stickers and memes: Off
  · Allow URL previews: On
  · Send urgent messages using priority notifications: Off
  Save. The rationale: Finance messages must be immutable once sent for audit purposes — only owners (managers) can delete. No informal media (giphy, memes) in Finance channels.
• Step 4 — Assign the Finance policy via group assignment (10 min)
  Navigate to Messaging policies → LL — Finance Messaging → Group policy assignment → + Add group. Select LL-Finance (the security group). Set rank to 1. Save.
  
  Wait 2–5 minutes for the assignment to propagate. Then navigate to Users → [any Finance user e.g. Priya Nair] → Policies tab. Confirm the effective messaging policy is now LL — Finance Messaging and note the assignment source (Group policy assignment).
• Step 5 — Configure an app permission policy (10 min)
  Navigate to Teams apps → Permission policies → Global (Org-wide default). Review the current settings for Microsoft apps, Third-party apps, and Custom apps.
  
  Create a custom policy: Apps → Permission policies → + Add. Name: LL — Restricted Apps.
  · Microsoft apps: Allow all apps
  · Third-party apps: Block all apps
  · Custom apps: Block all apps
  
  Assign this policy to Sarah Chen directly: Users → Sarah Chen → Policies → Edit → App permission policy → LL — Restricted Apps. Save.
• Step 6 — Verify effective policies (5 min)
  Navigate to Users → Tom Bellamy → Policies. Record every effective policy shown and note whether each came from Direct assignment, Group assignment, or Global default. Repeat for Priya Nair. Record and compare the two.

⭐ Bonus: Policy packages & PowerShell policy assignment

Reflection & preview

• Ask: "Priya Nair is in LL-Finance (rank 1 group assignment for messaging policy). She is also in LL-AllStaff. If you later assign the Global messaging policy to LL-AllStaff at rank 2, what messaging policy does Priya get?" — answer: LL-Finance Messaging, because rank 1 beats rank 2
• Ask: "You assigned the LL — Restricted Apps policy to Sarah Chen directly. Sarah's IT team has no group app policy assigned. What app policy does Dev Sharma (in LL-IT) get?" — answer: Global default, because Dev has no direct or group assignment
• Ask: "A Finance user reports they can't delete a message they sent 10 minutes ago in a Teams channel. They've never had this problem before. What is the most likely cause and how do you investigate?" — surface the effective policy check approach
• Exit ticket: describe the policy cascade in your own words — three tiers, which wins, and give a specific example of a user at Lakeview Logistics where two policies could conflict and explain which one they'd receive
• Preview Day 3: policies govern what internal users can do. Day 3 covers the external boundary — guest access and external access (federation). Students will pair with a classmate's tenant to test real B2B collaboration between two independent M365 organisations.